System and method for monitoring communications in a network

ABSTRACT

Methods and systems are described for monitoring communications in a packet-switched network. More specifically, the system initiates a communication between a network endpoint associated with a call mediator and at least a second network endpoint; records, at the call mediator, information associated with the communication; and upon termination of the communication, communicates, from the call mediator to an enterprise gatekeeper, the information associated with the communication.

RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.12/804,706, filed Jul. 26, 2010, now U.S. Pat. No. 8,885,494, which is acontinuation of U.S. patent application Ser. No. 10/629,521, filed Jul.29, 2003, now U.S. Pat. No. 7,764,670, each of which are herebyincorporated by reference in its entirety. This application is relatedto the following commonly owned patents and pending applications, eachof which is hereby incorporated herein by reference in its entirety:

Application Ser. No. 09/827,352, titled ALTERNATE ROUTING OF VOICECOMMUNICATIONS IN A PACKET-BASED NETWORK, filed Apr. 6, 2001; and

Application Ser. No. ______, titled SYSTEM AND METHOD FOR PROVIDINGALTERNATE ROUTING IN A NETWORK, filed concurrently herewith, AttorneyDocket No. 5630/6.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosures, as it appears in the Patent and TrademarkOffice patent files or records, but otherwise reserves all copyrightrights whatsoever.

BACKGROUND OF THE INVENTION

The invention disclosed herein relates generally to providing monitoringfunctionality in a communications network. More particularly, thepresent invention relates to monitoring packet-switched communications,such as Voice over Internet Protocol (“VoIP”) calls, to provide enhancedcall detail information which can be used for billing purposes, qualityof service (“QoS”) monitoring, network usage tracking, and other similarpurposes.

In conventional packet-switched networks, communications between networkendpoints are generally facilitated and managed by call mediators andenterprise gatekeepers. Traditionally, a VoIP network endpoint isassociated with a call mediator that is responsible for processing callsto and from the VoIP network endpoint. The call mediator in turn, usesH.323 signaling techniques or other protocols to communicate with anenterprise gatekeeper that is responsible for routing calls between callmediators in the enterprise.

While network endpoints and call mediators are generally located atcustomer sites, the enterprise gatekeeper for these systems generallyresides offsite. Thus, a common application service provider scenario isa company managing its own call mediator(s) and network endpoints in aparticular office, such as a branch office, and contracting with anentirely different company to provide packet-switched network servicesand to manage the enterprise gatekeeper(s) associated with thepacket-switched network. In some cases, however, companies maintaintheir own networks entirely having local endpoints, gatekeepers, andother system components that are part of their overall VoIP network.

When a communication occurs between two network endpoints, the callmediators associated with the endpoints are typically responsible forrecording and storing details associated with the communicationincluding, but not limited to the identity of the endpoints associatedwith a call, the start and stop times of a call, QoS metrics associatedwith a call, a cause code indicating why the communication terminated,and other similar information.

In commercial applications, these communication details are later usedto generate customer bills based on network usage and other businessfactors. When a system generates a customer bill, a billing server orother similar transaction processing module queries the various callmediators throughout the network to provide the communication detailsassociated with the customer that the call mediators have stored.Sometimes, call mediators also push this data to the billing server orother similar transaction processing module. The communication detailsare then aggregated and used to create the bill.

One problem associated with this method for service providers is thatthe billing system relies on data that is controlled by and stored at acustomer. Thus, there some risk of fraud associated with relying onunverified data. Further, retrieving communication details from manydifferent call mediators is resource intensive and inefficient. Inaddition, in some cases, call mediators store some communication detailsin formats that are not suited for processing by a given billing system.Finally, cases arise where communications are routed beyond callmediators, such as via the PSTN to endpoints located beyond a customer'ssite or network, and thus call mediators are not well-suited tocapturing communication details associated with circuit-switchednetworks.

There is thus a need for systems and methods that provide more reliablecommunication details to billing systems in packet-switched networks.There is also a need to make this information efficiently accessible andstored in formats suitable for processing by billing systems.

SUMMARY OF THE INVENTION

The present invention addresses, among other things, the problemsdiscussed above monitoring communications in a packet-switched network.

In accordance with some aspects of the present invention, computerizedmethods are provided for initiating a communication between a networkendpoint associated with a call mediator and at least a second networkendpoint, recording information associated with the communication at thecall mediator, and upon termination of the communication communicatingthe information associated with the communication from the call mediatorto an enterprise gatekeeper. In some embodiments of the invention, thecommunication comprises a VoIP communication.

Various different information associated with the communication isrecorded according to different embodiments of the invention. Forexample, in some embodiments, the information associated with thecommunication includes a network identifier associated with a networkendpoint, the start time of the communication, the stop time of thecommunication, the duration of the communication, an amount of datatransferred between the network endpoints, or a termination cause code.In some embodiments, the termination code an alphanumeric terminationcause code that may, at times, be translated into a numeric terminationcause code, such as a PSTN numeric termination cause code. In someembodiments, the alphanumeric termination cause code is translated bythe enterprise gatekeeper.

In some embodiments, the information associated with the communicationcomprises is associated with a disconnect request. For example, in someembodiments, a billing token or other similar data structure containedin a disconnect request contains the information associated with thecommunication. In some embodiments, the information associated with thecommunication is parsed to create an authentication record, such as aRADIUS record. In some embodiments, the authentication record iscommunicated from the enterprise gatekeeper to an a remoteauthentication server and parsed to create a billing call record. Insome embodiments, the billing call record is communicated to a billingserver for further processing.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is illustrated in the figures of the accompanying drawingswhich are meant to be exemplary and not limiting, in which likereferences are intended to refer to like or corresponding parts, and inwhich:

FIG. 1 presents a block diagram of an exemplary system for monitoringcommunications in a VoIP network according to one embodiment of thepresent invention;

FIG. 2 presents a flow diagram of a method for monitoring communicationsin a VoIP network according to one embodiment of the present invention;and

FIGS. 3a, 3b, and 3c present a series of flow diagrams illustrating amethod for monitoring communications in a VoIP network according to oneembodiment of the present invention.

DETAILED DESCRIPTION

With reference to FIGS. 1 through 3 c, embodiments of the invention arepresented. FIG. 1 presents a block diagram of an exemplary system formonitoring communications in a VoIP network according to one embodimentof the invention. Information associated with VoIP endpointcommunications is recorded at call mediators and transmitted to anenterprise gatekeeper for further processing by billing systems andother network systems.

As shown, the system includes VoIP network endpoints 100 located atclient sites 102, a call mediator 105, a router 110 connected to apacket-switched network such as a VoIP network 115, an overflow gateway120 connected to a circuit-switched network 125 such as the PSTN, PSTNendpoints 127, an enterprise gatekeeper 130, a translation gatekeeper135, a translation gateway 137, an inbound gatekeeper 140, an inboundgateway 145, an outbound gatekeeper 150, an outbound gateway 155, aninbound directory gatekeeper 160, an outbound directory gatekeeper 165,a remote authentication server 170, and a billing server 172.

A VoIP network endpoint 100 is generally a network node at a customersite 102 or other physical location comprising a network device suitablefor conducting communications in a VoIP network, such as, a VoIP-enabledtelephone handset, facsimile machine, video conferencing terminal, orother similar devices known in the art. In some embodiments, a VoIPnetwork endpoint 100 may comprise a general-purpose computer with audioinput and output capabilities suitable for conducting VoIPcommunications.

VoIP endpoints 100 generally maintain and execute client software tofacilitate VoIP, as well as other types of communications. For example,according to one embodiment of the invention, VoIP endpoints 100maintain and execute client software that adheres to the H.323 standard,which provides a foundation for audio, video, and data communicationsacross IP-based networks 115. The H.323 standard and its relatedannexes, available from the H.323 Forum at www.h323forum.org and at theInternational Telecommunication Union at www.itu.int, is herebyincorporated herein by reference in its entirety. Additionally, H.323 isan umbrella standard that describes the architecture of the conferencingsystem and refers to a set of other standards (H.245, H.225.0, Q.931,and others) to describe its actual protocol. Alternatively, the systemmay be implemented using H.323 analogous signaling techniques and othermethods associated with Session Initiation Protocol (“SIP”), MediaGateway Control Protocol (“MGCP”), or other well-known protocols fortransporting voice and other related data over communications networks.

Each VoIP endpoint 100 is associated with one or more identifyingnetwork addresses. For example, in some embodiments a VoIP endpoints 100is associated with an E.164 address as defined in the InternationalTelecommunication Union's international public telecommunicationnumbering plan, available athttp://www.itu.int/ITU-T/publications/index.html and hereby incorporatedherein by reference in its entirety. Alternatively, in otherembodiments, VoIP endpoints 100 are associated with IP addresses, H.323IDs, SIP URLs, MGCP endpoint names, and other network addressidentifiers known in the art. In some embodiments, for example where aPBX is fronted by a VoIP gateway, endpoints may comprise digital oranalog phones associated with E.164 addresses and other network addressidentifiers known in the art.

VoIP endpoints 100 are connected to a call mediator 105. The callmediator 105 is generally a software or hardware module, such as anIP-PBX, a PBX with a VoIP interface, a PBX fronted by a gateway, orother similar device that is generally responsible for handlingintra-network communications. For example, the call mediator 105generally handles calls between two endpoints 100 at the same enterprisesite. The call mediator 105 is also generally responsible for presentingor otherwise delivering calls to other network elements in a privatedialing plan (“PDP”) format, in the PSTN-based format such as E.164 orprefixed-national, or other format suitable for routing through the VoIPnetwork 115. In some embodiments, the call mediator 105 is located at acustomer site 102 or other enterprise site and stores call data andother data regarding calls processed by the call mediator 105.

The call mediator 105 is connected to a circuit-switched network 125,such as the PSTN, via an overflow gateway 120. In some embodiments, suchas with TDM PBX's and other PBXs, call mediators 105 and other systemcomponents may be connected directly to the PSTN without requiring anoverflow gateway 120. Gateways, as described herein, generally functionas an entrance or an exit to another network. Gateways, for example,translate IP-based communications to PSTN-based communications, orvice-versa, and serve as a bridge between these different network types.A gateway typically has a PSTN interface connected to the PSTN 125 andan IP interface connected a VoIP network 115. In some embodiments, asfurther described herein, gateways also translate numbers and othernetwork addresses by expanding or otherwise manipulating PDP numbers orother similar numbers dialed into formats suitable for transmission on aparticular network such as a PSTN 125 or a VOIP network 115.

The overflow gateway 120 enables the call mediator 105 to route callsdirectly to the PSTN 125 and to PSTN endpoints 127 by bypassing the VoIPnetwork 115. PSTN endpoints 127 generally comprise but are not limitedto traditional (non-VoIP) telephones, facsimile machines, and othersimilar devices known in the art. The call mediator 105 is connected toa packet-switched network 115, such as a VoIP network, via a router 110.Communications from the call mediator 105 to the VoIP network 115 aregenerally received by the enterprise gatekeeper 130 for furtherprocessing.

The enterprise gatekeeper 130 functions as a management component forfacilitating VoIP communications and, among other things, is generallyresponsible for providing communication routing and control decisions tovarious elements of the system such as call mediators 105, translationgatekeepers 135, inbound gatekeepers 140, inbound gateways 145, outboundgatekeepers 150, outbound gateways 155, inbound directory gatekeepers160, outbound directory gatekeepers 165, and other devices or softwaremodules. According to embodiments of the invention, the enterprisegatekeeper 130 also functions in conjunction with various elements ofthe system such as call mediators 105, translation gatekeepers 135,inbound gatekeepers 140, inbound gateways 145, outbound gatekeepers 150,outbound gateways 155, inbound directory gatekeepers 160, outbounddirectory gatekeepers 165, and other devices or software modules toprocess and route communications between network endpoints as furtherdescribed in application Ser. No. ______, titled SYSTEM AND METHOD FORPROVIDING ALTERNATE ROUTING IN A NETWORK, filed concurrently herewith,and in application Ser. No. 09/452,915, titled MULTISERVICE NETWORK,filed Dec. 1, 1999, attorney docket number GTE-99-302, both of which arehereby incorporated by reference in their entirety. For example, theenterprise gatekeeper 130, based on a called number received from a callmediator 105 and in conjunction with other system components, providesfunctionality to route the call to the IP address or other networkidentifying address of the destination endpoint 100.

The enterprise gatekeeper 130 is also generally connected to anauthentication server 170 executing an authentication module comprisingvarious combinations of hardware or software for controlling access tocomputer resources, enforcing policies, auditing usage, providingadditional information which may be used to bill for services, and otheruseful functions. For example, in some embodiments, the authenticationserver 170 implements the Remote Authentication Dial-In User Service(“RADIUS”) protocol to perform authentication services. The RADIUSprotocol was initially developed by Lucent Technologies and furtherdescribed in Request for Comments (“RFC”) 2865 published by the InternetEngineering Task Force (“IETF) which is hereby incorporated herein byreference in its entirety and also available athttp://www.ietforg/rfc/rfc2865.txt.

The authentication server 170 is also generally in communication with abilling server 175 executing a billing module comprising variouscombinations of software or hardware for performing billing functionsfor the system. For example, the billing module tracks usage of systemresources, call durations, and other factors to generate bills andperform other useful billing functions. In some embodiments, theauthentication server 170 passes RADIUS records and other informationregarding network and resource usage to the billing server 175 for usein performing billing functions.

FIG. 2 presents a high-level flow diagram of a method for monitoringcommunications in a VoIP network according to one embodiment of theinvention. The system performs a communication setup, step 175. Forexample, in some embodiments, the system performs a VoIP call setupbetween two network endpoints as further described in application Ser.No. ______, titled SYSTEM AND METHOD FOR PROVIDING ALTERNATE ROUTING INA NETWORK, filed concurrently herewith, Attorney Docket No. 5630/6 whichis hereby incorporated herein by reference in its entirety.

The communication is monitored, and details such as the duration of thecommunication, network resources used by the communication, bandwidthused by the communication, and other communication metrics are recorded,step 180. A variety of different network components perform monitoring,either singly or in combination according to various embodiments of theinvention. For example, in some embodiments, components such as the callmediator(s), the enterprise gatekeeper, routers, endpoints, and othergatekeepers and gateways described in FIG. 1 monitor communications thatpass through them or that they process and record the associatedcommunication metrics.

The communication terminates, step 185, and the communication detailsare reported to a designated system component directed to processing thecommunication details, step 190. For example, a communication mayterminate due to a network or network component failure, or acommunication may terminate when a user or other process ends thecommunication. In some embodiments, communication details recorded bysystem components are aggregated or otherwise reported to an enterprisegatekeeper. The enterprise gatekeeper may process the communicationdetails directly, perform preprocessing of the details, or send them toan authentication server, such as a RADIUS server, or billing server forprocessing. In some embodiments, the RADIUS server and the billingserver operate in conjunction to process the communication details andgenerate a bill for the network resources or services used by thecommunication.

FIGS. 3a, 3b, and 3c present flow diagrams of a method for monitoringcommunications in a VoIP network according to one embodiment of theinvention. A caller initiates a communication from an originationendpoint, such as a VoIP endpoint, to a destination endpoint, such asanother VoIP endpoint or a PSTN endpoint, step 195. For example, a usercould use a VoIP-enabled phone to dial a number directed to atraditional telephone on the PSTN or to a VoIP-enabled telephoneconnected to the VoIP network.

The call mediator determines whether the number or other networkidentifier, such as the IP address, of destination endpoint for thecommunication should be translated before being sent to the enterprisegatekeeper or other system components, step 200, and if necessary,translates the number into an appropriate format, step 205. Multiplecall mediators from different enterprise sites or even differententerprises may share the services of the same enterprise gatekeeper andother system components. Thus, in some embodiments, the system requiresa unique customer-specific identifier (“CSID”) prepended to all privatedialing plan numbers in order to identify the endpoints associated withthe each specific call mediator. The CSID is used by the enterprisegatekeeper and other system components to distinguish between differentcustomers, enterprises, sites, and call managers. Otherwise, forexample, two different customers might be using the same numbers fortheir PDPs, and without the CSID, the enterprise gatekeeper receiving aPDP number such as “5678” would have difficulty distinguishing whichcustomer's endpoint associated with “5678” was the actual intendedrecipient of a communication. CSIDs are thus associated with callmediators and stored in memory accessible to the enterprise gatekeeper.In some embodiments, the call mediator prepends a CSID to all callsbefore sending them to the enterprise gatekeeper.

Further, in some embodiments, the system also requires a technologyprefix added to numbers that might be routed to other networks, such asthe PSTN. For example, in some embodiments, the call mediator prepends atechnology prefix such as “96#” to all numbers intended for the PSTN.The enterprise gateway and other elements recognize the technologyprefix, and provide additional routing services as further describedherein. In some embodiments, the call mediator also formats PDP numbersas an E.164 address so that, among other things, calls can bealternately routed to the PSTN to complete the communication as furtherdescribed in application Ser. No. ______, titled SYSTEM AND METHOD FORPROVIDING ALTERNATE ROUTING IN A NETWORK, filed concurrently herewith.

As further described herein, the system uses a number of standardsincluding H.323, H.225, H.245, and other signaling techniques known inthe art to facilitate communications between system components. The callmediator sends an admission request (“ARQ”) message to the enterprisegatekeeper requesting access to the VoIP network, step 210. The ARQ sentto the enterprise gatekeeper includes the number or other networkidentifier of the destination endpoint.

The enterprise gatekeeper either consulting network mappings by itselfor in conjunction with an outbound directory gatekeeper determineswhether a call mediator associated with the destination endpoint can beidentified to route the call, step 215.

If a call mediator associated with the destination endpoint cannot beidentified, then the enterprise gatekeeper returns an admissionrejection (“ARJ”) to the call mediator that sent the ARQ, and the callmediator either terminates the call or directly routes the call, ifpossible, via an overflow gateway to alternate network, such as a PSTN,step 220.

Otherwise, if a call mediator associated with the destination endpointis identified, the enterprise gatekeeper determines, according toselection criteria, whether there are sufficient resources to setup thecall via the VoIP network, step 225. In some embodiments, selectioncriteria include bandwidth exceeding a specified amount, availability ofsystem components, and other criteria useful in determining whether toroute a communication. For example, the enterprise gatekeeper mightdetermine whether there is sufficient bandwidth available to enable avoice or other media stream at a specified minimal QoS. Alternatively,the system might check to ensure that various system resources such asgatekeepers, gateways, routers, and other system components wereavailable to route the call to its intended destination.

If the enterprise gatekeeper determines that sufficient resources do notexist to setup the call, then the enterprise gatekeeper communicates anARJ to the call mediator that the call cannot be routed via the VoIPnetwork, and should be alternately routed via the PSTN as furtherdescribed in application Ser. No. ______, titled SYSTEM AND METHOD FORPROVIDING ALTERNATE ROUTING IN A NETWORK, filed concurrently herewith,step 230. In some embodiments, the enterprise gatekeeper communicates anARJ to the call mediator indicating that the call mediator isresponsible for the call and that the communication should either failor be routed by the call mediator via an overflow gateway directly tothe PSTN using an alternate E.164 equivalent number or other similarnumber if available.

If sufficient resources exist, however, the enterprise gatekeeper sendsto the call mediator associated with the origination endpoint an ACFcontaining the IP address or other identifying network address of thecall mediator associated with the destination endpoint, and an H.245media stream setup commences between the call mediator associated withthe origination endpoint and the call mediator associated with thedestination endpoint, step 235. The call mediator associated with thedestination endpoint sends an ARQ to the enterprise gateway, step 240.

In some embodiments, the enterprise gatekeeper does not perform a secondcheck to determine whether there are sufficient resources to setup thecall using the VoIP network and control proceeds directly to step 255.In other embodiments (as shown in FIG. 3b ), the enterprise gatekeeperagain determines, according to selection criteria, whether there aresufficient resources to setup the call via the VoIP network, step 245.If the enterprise gatekeeper determines that sufficient resources do notexist to setup the call, then the enterprise gatekeeper communicates anARJ to the call mediator associated with the destination endpoint thatthe call cannot be routed via the VoIP network, and should bealternately routed via the PSTN, step 250.

Otherwise, if sufficient resources exist, the enterprise gatekeepersends an ACF to the call mediator associated with the destinationendpoint, and an H.245 media stream setup commences between the callmediator associated with the origination endpoint and the call mediatorassociated with the destination endpoint, step 255.

The call mediator associated with the origination endpoint creates astart record that is sent to the enterprise gatekeeper, step 260. Thestart record indicates communication-related information such as starttime of the communication, the network address of the originatingendpoint, the network address of the destination endpoint, dialednumbers or other network identifiers associated with endpoints of thecommunication, and other similar information.

Continuing with FIG. 3c , the media stream commences between the twoendpoints and their associated call mediators, step 265, and thecommunication continues until the media stream is terminated, step 270.For example, a communication may terminate when a user indicates thatthey are finished and that a call or communication should bedisconnected. As another example, a communication may terminate due to ahardware or software failure that makes the system unable to continuethe call. In some embodiments, a real time transport protocol (“RTP”)voice stream or other media stream begins between the two callmediators, and the call mediators route the stream to their respectiveendpoints. RTP is a protocol that specifies a method for programs tomanage transmission of multimedia data, and is further described in theIETF RFC 1889, available at http://www.ietf.org/rfc/rfc1889.txt, whichis hereby incorporated herein by reference in its entirety.

When the communication terminates, the call mediator associated with theorigination endpoint generates a disconnect request (“DRQ”) containing astop record or billing token that is sent to the enterprise gatekeeper,step 275. For example, in some embodiments, the billing token containscommunication-related information such as the network addresses of theorigination endpoint and the destination endpoint, any other networkidentifiers associated with the endpoints, the start time of thecommunication, the stop time of the communication, an amount of datatransferred, protocols associated with the communication, session IDsassociated with the communication, PDP numbers associated with networkidentifiers for endpoints, a termination cause code indicating thereason that the communication was disconnected, and other similarinformation. For example, a cause code may indicate that a user manuallyterminated the communication by hanging up the receiver of an endpoint.Exemplary billing tokens generated by various types of communicationsaccording to embodiments of the invention are set forth in Appendix Aattached hereto. For example, Appendix A sets forth exemplary billingtokens generated when a called party answers and disconnections, when acalling party calls an unknown number, when a busy number is called,when a call is placed to a phone that is listed in the call manager andnot registered on the network, and when a call manager is unregistered.

Termination cause codes are, among other things, useful for performingdiagnostics on the network, and also for generating billing information.For example, cause codes can be used to filter calls which should not bebilled from a set of total calls. In some cases, it might not, forexample, be desirable to bill a user for a call which terminated due tonetwork failure or due to a busy signal. Thus, cause codes can be usedto ensure that billing occurs only for properly terminatedcommunications such as termination due to user action and othersimilarly appropriate events.

In some embodiments, call mediators generate alphanumeric cause codeswhile enterprise gatekeepers and other gatekeepers in packet-switchednetworks such as VoIP networks, are directed to processing only numericcause codes. For example, in some embodiments, the gatekeepers processnumeric cause codes based on traditional PSTN cause codes as is known inthe art. Thus, a DRQ from a call mediator might contain a cause code “noanswer from user”, however, the enterprise gatekeeper and othercomponents of the VoIP network are directed to processing the cause codewhen it is formatted as a traditional PSTN cause code “19” for such anevent. In such embodiments, the alphanumeric cause codes from the callmediator must be parsed or otherwise translated into formats appropriatefor processing by other components of the VoIP network.

Thus, in some embodiments, the enterprise gatekeeper parses the DRQ andthe billing token to generate an authentication record, such as a RADIUSrecord, step 280, which is sent to a remote authentication server, suchas RADIUS server, step 285. For example, the enterprise gatekeeperparses the call details from fields of the billing token, and maps thisinformation to corresponding fields in a RADIUS record. Any alphanumericcause code generated by a call mediator is translated into a PSTN causecode and also incorporated into the RADIUS record.

The remote authentication server parses the authentication record togenerate a call detail record, step 290. For example, in someembodiments, a RADIUS record created by the enterprise gatekeepercontains information useful for performing customer billing such as theduration of a communication, identification of the endpoints associatedwith the communication, the amount of data transferred during the call,a cause code indicating the reason the call was terminated, and othersimilar information. Thus, information is encoded into a call detailrecord format suitable for processing by a billing server, and then sentby the authentication server to the billing server for furtherprocessing, step 295. For example, in some embodiments, the billingserver processes call detail records to generate bills for usercommunications.

Systems and modules described herein may comprise software, firmware,hardware, or any, combination(s) of software, firmware, or hardwaresuitable for the purposes described herein. Software and other modulesmay reside on servers, workstations, personal computers, computerizedtablets, PDAs, and other devices suitable for the purposes describedherein. Software and other modules may be accessible via local memory,via a network, via a browser or other application in an ASP context, orvia other means suitable for the purposes described herein. Datastructures described herein may comprise computer files, variables,programming arrays, programming structures, or any electronicinformation storage schemes or methods, or any combinations thereof,suitable for the purposes described herein. User interface elementsdescribed herein may comprise elements from graphical user interfaces,command line interfaces, and other interfaces suitable for the purposesdescribed herein. Screenshots presented and described herein can bedisplayed differently as known in the art to input, access, change,manipulate, modify, alter, and work with information.

While the embodiments of the invention have been described andillustrated in connection with preferred embodiments, many variationsand modifications as will be evident to those skilled in this art may bemade without departing from the spirit and scope of the invention, andthe invention is thus not to be limited to the precise details ofmethodology or construction set forth above as such variations andmodification are intended to be included within the scope of theinvention.

Section A

The following represent sample billing tokens that are generated byvarious exemplary communications according to embodiments of theinvention:

<<Called party answers and disconnects>> Mon Nov 19 14:34:35 2001NAS-IP-Address = 198.92.215.163 NAS-Port-Type = Async User-Name =“cm2.evoice-gk1” Called-Station-Id = “16176871391” Calling-Station-Id =“7816343121” Acct-Status-Type = Stop Service-Type = Login-Userh323-gw-id = “h323-gw-id=192.168.3.9” h323-conf-id =“h323-conf-id=80A9FA23 25FB611D 110031CB C0A80313” h323-call-origin =“h323-call-origin=originate” h323-call-type = “h323-call-type=VoIP”h323-remote-address = “h323-remote-address=198.92.213.49”h323-connect-time = “h323-connect-time=19:26:58.000 GMT Mon Nov 19 2001”h323-disconnect-time = “h323-disconnect-time=19:27:00.000 GMT Mon Nov 192001” h323-disconnect-cause = “h323-disconnect-cause=16” Acct-Session-Id= “0000005F” Acct-Input-Octets = 0 Acct-Output-Octets = 0Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 5Cisco-AVPair = “pre-bytes-in=0” Cisco-AVPair = “pre-bytes-out=0”Cisco-AVPair = “pre-paks-in=0” Cisco-AVPair = “pre-paks-out=0”Cisco-AVPair = “nas-rx-speed=0” Cisco-AVPair = “nas-tx-speed=0”Acct-Delay-Time = 0 Client-IP-Address = 198.92.215.163 Timestamp =1006198475 Request-Authenticator = None <<Calling Party calls unknownnumber>> Mon Nov 19 14:36:29 2001 NAS-IP-Address = 198.92.215.163NAS-Port-Type = Async User-Name = “cm2.evoice-gk1” Called-Station-Id =“16176871333” Calling-Station-Id = “7816343121” Acct-Status-Type = StopService-Type = Login-User h323-gw-id = “h323-gw-id=192.168.3.9”h323-conf-id = “h323-conf-id=9FE86A 25FB611D 130031CB C0A80313”h323-call-origin = “h323-call-origin=originate” h323-call-type =“h323-call-type=VoIP” h323-remote-address =“h323-remote-address=198.92.213.49” h323-connect-time =“h323-connect-time=19:28:54.000 GMT Mon Nov 19 2001”h323-disconnect-time = “h323-disconnect-time=19:28:54.000 GMT Mon Nov 192001” h323-disconnect-cause = “h323-disconnect-cause=1” Acct-Session-Id= “00000061” Acct-Input-Octets = 0 Acct-Output-Octets = 0Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 0Cisco-AVPair = “pre-bytes-in=0” Cisco-AVPair = “pre-bytes-out=0”Cisco-AVPair = “pre-paks-in=0” Cisco-AVPair = “pre-paks-out=0”Cisco-AVPair = “nas-rx-speed=0” Cisco-AVPair = “nas-tx-speed=0”Acct-Delay-Time = 0 Client-IP-Address = 198.92.215.163 Timestamp =1006198589 Request-Authenticator = None <<Calls busy number>> Mon Nov 1914:38:30 2001 NAS-IP-Address = 198.92.215.163 NAS-Port-Type = AsyncUser-Name = “cm2.evoice-gk1” Called-Station-Id = “16176871391”Calling-Station-Id = “7816343122” Acct-Status-Type = Stop Service-Type =Login-User h323-gw-id = “h323-gw-id=192.168.3.9” h323-conf-id =“h323-conf-id=80C107B3 25FB611D 150016C8 C0A80317” h323-call-origin =“h323-call-origin=originate” h323-call-type = “h323-call-type=VoIP”h323-remote-address = “h323-remote-address=198.92.213.49”h323-connect-time = “h323-connect-time=19:30:55.000 GMT Mon Nov 19 2001”h323-disconnect-time = “h323-disconnect-time=19:30:55.000 GMT Mon Nov 192001” h323-disconnect-cause = “h323-disconnect-cause=17” Acct-Session-Id= “00000065” Acct-Input-Octets = 0 Acct-Output-Octets = 0Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 0Cisco-AVPair = “pre-bytes-in=0” Cisco-AVPair = “pre-bytes-out=0”Cisco-AVPair = “pre-paks-in=0” Cisco-AVPair = “pre-paks-out=0”Cisco-AVPair = “nas-rx-speed=0” Cisco-AVPair = “nas-tx-speed=0”Acct-Delay-Time = 0 Client-IP-Address = 198.92.215.163 Timestamp =1006198710 Request-Authenticator = None <<Calls phone not registered.Call exists in CM, but not there.>> Mon Nov 19 14:39:57 2001NAS-IP-Address = 198.92.215.163 NAS-Port-Type = Async User-Name =“cm2.evoice-gk1” Called-Station-Id = “16176871397” Calling-Station-Id =“7816343123” Acct-Status-Type = Stop Service-Type = Login-Userh323-gw-id = “h323-gw-id=192.168.3.9” h323-conf-id =“h323-conf-id=807D7BE7 25FB611D 1600EEC2 C0A80314” h323-call-origin =“h323-call-origin=originate” h323-call-type = “h323-call-type=VoIP”h323-remote-address = “h323-remote-address=198.92.213.49”h323-connect-time = “h323-connect-time=19:32:23.000 GMT Mon Nov 19 2001”h323-disconnect-time = “h323-disconnect-time=19:32:23.000 GMT Mon Nov 192001” h323-disconnect-cause = “h323-disconnect-cause=41” Acct-Session-Id= “00000066” Acct-Input-Octets = 0 Acct-Output-Octets = 0Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 0Cisco-AVPair = “pre-bytes-in=0” Cisco-AVPair = “pre-bytes-out=0”Cisco-AVPair = “pre-paks-in=0” Cisco-AVPair = “pre-paks-out=0”Cisco-AVPair = “nas-rx-speed=0” Cisco-AVPair = “nas-tx-speed=0”Acct-Delay-Time = 0 Client-IP-Address = 198.92.215.163 Timestamp =1006198797 Request-Authenticator = None <<Call Manager not registered>>Mon Nov 19 14:47:27 2001 NAS-IP-Address = 198.92.215.163 NAS-Port-Type =Async User-Name = “cm1.evoice-gk1” Called-Station-Id = “17816343123”Calling-Station-Id = “6176871390” Acct-Status-Type = Stop Service-Type =Login-User h323-gw-id = “h323-gw-id=198.92.213.49” h323-conf-id =“h323-conf-id=80F9FD31 28FB611D 10084CE C65CD526” h323-call-origin =“h323-call-origin=originate” h323-call-type = “h323-call-type=VoIP”h323-remote-address = “h323-remote-address=198.92.215.170”h323-connect-time = “h323-connect-time=19:39:53.000 GMT Mon Nov 19 2001”h323-disconnect-time = “h323-disconnect-time=19:39:53.000 GMT Mon Nov 192001” h323-disconnect-cause = “h323-disconnect-cause=16” Acct-Session-Id= “00000069” Acct-Input-Octets = 0 Acct-Output-Octets = 0Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 0Cisco-AVPair = “pre-bytes-in=0” Cisco-AVPair = “pre-bytes-out=0”Cisco-AVPair = “pre-paks-in=0” Cisco-AVPair = “pre-paks-out=0”Cisco-AVPair = “nas-rx-speed=0” Cisco-AVPair = “nas-tx-speed=0”Acct-Delay-Time = 0 Client-IP-Address = 198.92.215.163 Timestamp =1006199247 Request-Authenticator = None

What is claimed is:
 1. A computerized method for monitoringcommunications in a packet switched network, the method comprising:initiating a communication between a network endpoint associated with acall mediator and at least a second network endpoint; recording, at thecall mediator, information associated with the communication; and upontermination of the communication, communicating, from the call mediatorto an enterprise gatekeeper, the information associated with thecommunication.